74c24599d5eae5bccc74bd1d7ddadc86b1f5dd11d83f3d0367f4e15744a2ea25

General

Target

3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Size

660KB
MD5

3f618ae55b335f2a916b747503a39c58
SHA1

1d8e19c16c4c1c7af8c38bd4ea4f1c9687e41129
SHA256

74c24599d5eae5bccc74bd1d7ddadc86b1f5dd11d83f3d0367f4e15744a2ea25
SHA512

b8b0c2e67b99ed459c0b9a79272783aef3f2936600db2e22bc08a2c96f562c038825483562456b43d394f3696843de9435a887664e5d0060d32af123c99ede96
SSDEEP

12288:vc4HfCyyq3+zhw/9vhsHum8WGn8TNNtXAd/cYbQQNWQvviR1qxYNpl/RF0k3hf1:04HfCHqDsOD16fQyiQQNN3iR1n7HNhf1

Score

7^/10

persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2332	svchost.exe
1968	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSN = "C:\\Windows\\svchost.exe"	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.exe	svchost.exe
File created	C:\Windows\svchost.exe	svchost.exe
File created	C:\Windows\svchost.exe	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\dqCgAvduehqp = "PD]Yf{}\|edToU@dnznHFzNY}yjf"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\nTdbpjL = "CsOA@LxSCKF}HvM}\|\x7fvJkKw]"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\ydsm = "KZNS`uruMKLfNp"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\mnkdiqF = "K{@_l[Ijs\|VGwDml\\[iKevrH\x7f[IYC"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\ = "DfMarshal"	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\InprocServer32	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\nTdbpjL = "Cs\x7fA@LxSCKv}HvM}\|\x7fvJkKw]"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\ydsm = "KZNc`uruNVx`Fo"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\InprocServer32\ = "ole32.dll"	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\wxTKmvpRR = "\x7fkqVJqauOr}IrNDH"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\caglFjgc = "S\|Gy@GLZphytY\x7f^LiX["	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCC3FE02-DA4F-1374-101F-E782E416F147}\fRChc = "lpa\\nMRViS~m\x7fVo`ILjeDZYbqTQCJ^Y"	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Token: 33	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
Token: 33	1968	svchost.exe
Token: SeIncBasePriorityPrivilege	1968	svchost.exe
Token: 33	1968	svchost.exe
Token: SeIncBasePriorityPrivilege	1968	svchost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2364	2556	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2332	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2332	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2332	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2332	2364	3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe	31
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32
PID 2332 wrote to memory of 1968	2332	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3f618ae55b335f2a916b747503a39c58_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\svchost.exe
    "C:\Windows\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
660KB

MD5
3f618ae55b335f2a916b747503a39c58

SHA1
1d8e19c16c4c1c7af8c38bd4ea4f1c9687e41129

SHA256
74c24599d5eae5bccc74bd1d7ddadc86b1f5dd11d83f3d0367f4e15744a2ea25

SHA512
b8b0c2e67b99ed459c0b9a79272783aef3f2936600db2e22bc08a2c96f562c038825483562456b43d394f3696843de9435a887664e5d0060d32af123c99ede96

Download Submit
memory/1968-38-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1968-29-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1968-42-0x0000000000330000-0x00000000003C5000-memory.dmp

Filesize
596KB

Download
memory/1968-41-0x0000000000330000-0x00000000003C5000-memory.dmp

Filesize
596KB

Download
memory/1968-40-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1968-39-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1968-25-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1968-30-0x0000000000330000-0x00000000003C5000-memory.dmp

Filesize
596KB

Download
memory/1968-35-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2332-45-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2332-23-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-13-0x0000000001EE0000-0x0000000001F75000-memory.dmp

Filesize
596KB

Download
memory/2364-12-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-11-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-2-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-26-0x0000000001EE0000-0x0000000001F75000-memory.dmp

Filesize
596KB

Download
memory/2364-10-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-9-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2364-4-0x0000000001EE0000-0x0000000001F75000-memory.dmp

Filesize
596KB

Download
memory/2364-3-0x000000000049D000-0x000000000049E000-memory.dmp

Filesize
4KB

Download
memory/2556-27-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2556-1-0x0000000000590000-0x00000000006AE000-memory.dmp

Filesize
1.1MB

Download
memory/2556-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads